* fix(logs): split summary/detail contracts to make trace tab gate type-safe
The Trace tab was silently missing from the Log Details sidepanel because
list and detail rows shared one WorkflowLog type with executionData:
z.unknown(). The UI couldn't distinguish a summary row (no spans) from a
detail row (with spans), so the tab gate read undefined and hid itself.
Splits into WorkflowLogSummary (list) and WorkflowLogDetail (typed
executionData with optional traceSpans). Detail and by-execution routes
both write through to the same logKeys.detail(id) cache, eliminating the
two-key fragmentation that caused the merge memo workaround. List route
moves to cursor pagination on (sortValue, id) with proper NULLS LAST
handling and SQL-side sort across workflow + job execution tables.
Detail route now requires and asserts workspaceId. Deep-link path uses
useLogByExecutionId instead of auto-paginating the entire workspace.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): audit follow-ups — render side-effect, stats invalidation, enhanced spread order
- Move onActiveTabChange call from render into useEffect to avoid
side-effects during render (StrictMode safety).
- Re-add logKeys.stats() invalidation to cancel/retry mutations so
the dashboard reflects status flips immediately.
- Reorder enhanced: true after ...execData spread in detail and
by-execution routes so the literal discriminator is never
overwritten by stale execData.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): mirror SQL NULLS LAST in JS merge for cursor consistency
The in-memory merge of workflow + job pages negated the comparator
for DESC, which placed null sort values at the start. SQL orders
both ASC and DESC with NULLS LAST, so DESC pages emitted a cursor
{v: <last non-null>, id: ...} while null rows still satisfied the
cursor predicate (OR sort_expr IS NULL) on the next page —
producing duplicate null rows across pages on cost/duration sorts.
Handle nulls explicitly in the JS comparator so they always sort
last regardless of direction, matching the SQL ordering.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): final-audit follow-ups — stable tab callback, byExecution invalidation, optimistic detail patch, trace loading state
- Wrap LogDetails -> LogDetailsContent onActiveTabChange in useCallback
so the child useEffect doesn't refire on every parent render.
- Add logKeys.byExecutionAll() to cancel + retry invalidation so the
table-embedded sidebar picks up status changes immediately.
- Optimistic write-through to logKeys.detail in useCancelExecution so
the open sidebar reflects 'cancelling' instantly; rolls back on error.
- Distinguish trace loading from trace-empty: when log.executionData is
not yet fetched, render "Loading trace…" instead of the empty state.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(logs): migrate stores/components to contract types
Replace the legacy `WorkflowLog` / `LogsResponse` / `WorkflowData` /
`CostMetadata` / `ToolCallMetadata` shapes in
`stores/logs/filters/types.ts` with direct use of the contract types
`WorkflowLogSummary`, `WorkflowLogDetail`, and a new `WorkflowLogRow`
alias for surfaces that render either form. Removes the
`summaryToWorkflowLog` / `detailToWorkflowLog` bridge in the React
Query layer along with their double-cast annotations.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(logs): address PR review feedback
- Whitelist sort columns against logSortBy enum to prevent client crash
when non-sortable headers (workflow, trigger) reach the contract parser.
- Extract fetchLogDetail helper shared by /api/logs/[id] and
/api/logs/by-execution/[executionId] — collapses ~360 duplicated lines
to a single source of truth keyed on lookup column.
* fix(logs): exclude job logs when level filter is workflow-only
When level=running or level=pending (workflow-only states involving
endedAt/pausedExecutions semantics), jobLevelConditions stayed empty
so no level constraint reached jobConditions — every job log in the
workspace leaked into the result. Skip the job side entirely when the
level filter has no job-applicable values (error/info).
* chore(logs): drop dead utils — mapToExecutionLog and friends
Remove ExecutionLog/RawLogResponse/ExecutionCost/LogWithExecutionData/
TraceSpan/BlockExecution interfaces and the mapToExecutionLog,
mapToExecutionLogAlt, extractOutput functions — all unreferenced after
the contract split. -212 lines.
* chore(logs): drop unused LOG_COLUMN_ORDER and LogColumnKey
* fix(logs): hydrate filters from URL synchronously on mount
The previous useEffect-based initializeFromURL caused useLogsList and
useDashboardStats to fire once with default store filters, then refetch
after the effect updated filters from the URL. Move the initial hydrate
into a useState lazy initializer so the first render already reads
URL-derived filters; the popstate handler keeps the existing effect for
back/forward navigation.
* chore(logs): trim verbose comments added during PR
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): guard navigation arrows when selected log is off-page
Deep-linked logs resolved via useLogByExecutionId may not be in the
current page list, leaving selectedLogIndex at -1. The hasNext prop
was evaluating -1 < logs.length - 1 (true for any non-empty list),
which enabled the next arrow and jumped to the first item on click.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(logs): sync active-tab callback before paint to keep keyboard guards aligned
Run the resolvedTab → onActiveTabChange propagation in useLayoutEffect
so the parent's activeTabRef updates synchronously before the next
paint. This closes the brief window where window keydown handlers
in the logs page would still see activeTabRef.current === 'trace'
and short-circuit arrow-key navigation immediately after switching
to a log without a Trace tab.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(copilot): redact sim_key API keys from persisted Mothership chat messages
* improvement(emcn): promote ApiKeyReveal to SecretReveal in emcn
* fix(copilot): thread cursor across content blocks when restoring sim_key tags
* fix(mothership): stop persisting log resources from get_workflow_logs and self-heal stale log panel entries
* fix(mothership): skip retries on 404 in useLogDetail for instant self-heal
* fix(mothership): simplify onNotFoundRef sync to inline assignment
* fix(mothership): catch draft restore errors instead of crashing /home
Wrap the mount-time draft restore in try/catch with clearDraft on
throw, and coerce text to a string in the useState initializer.
A corrupt entry in mothership-drafts:v1 localStorage previously took
down the entire workspace via the error boundary.
* fix(mothership): defer state writes and log restore failures
Build the restored state in locals first and only apply on success
so a partial throw can't leave stale contexts in the UI with the
draft already cleared. Switch the empty catch to logger.error so
corrupt-draft incidents surface in production logs.
* feat(knowledge): expose Cohere reranker controls on knowledge block
Add a self-hosted Cohere API key field (mirroring the agent block's hosted-key
pattern), a configurable reranker input pool size (1-100), and surface
meta.warnings from Cohere rerank responses via logger.warn. All new contract
fields are optional and nullable for full backwards compatibility.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(knowledge): address PR feedback on Cohere reranker controls
- Drop required:true on apiKey field — server has BYOK→env→rotation fallback
chain, so self-hosted users with COHERE_API_KEY env should not be blocked
- Drop .min(1) on rerankerApiKey contract field so empty strings coerce to
undefined via the transform (matches the existing query field pattern)
- Log a warning when rerankerInputCount is clamped up to topK so users notice
their setting was overridden
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(knowledge): mirror agent block API key visibility for Cohere reranker
Restore required:true on the Cohere API Key field and hide it server-side via
a new NEXT_PUBLIC_COHERE_CONFIGURED public env flag — same pattern the Agent
block uses for Azure (NEXT_PUBLIC_AZURE_CONFIGURED). Self-hosters who set
COHERE_API_KEY in their environment also set NEXT_PUBLIC_COHERE_CONFIGURED=true,
which removes the field from the UI; everyone else sees a required field.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(knowledge): treat empty rerankerInputCount as unset
An empty string from the Documents Sent to Reranker input passed the
undefined/null guard, so Number('') = 0 → clamped to 1, sending only 1
document to the reranker instead of falling back to the 4× topK auto
default. Add the empty-string check to the guard.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): align upload route image extensions with picker
* fix(files): widen image mime mapping for chat/profile/logo uploads
* fix(files): fall back to extension when MIME is generic for image-only uploads
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): add new image extensions to EXTENSION_TO_MIME map
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): skip non-Claude image MIMEs in createFileContent
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): resolve content type for image-only contexts when MIME is generic
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(files): cover image/jpg in Claude gate, reverse MIME map, audit metadata
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(files): allow image uploads in workspace files
* fix(files): include images in workspace type filter
* fix(files): match all image mime types in image filter
* feat(files): export markdown as zip with embedded images in assets/ folder
* fix(files): sanitize zip filenames, fix storage context cast, cap embedded image count
* fix(files): fix race condition in asset filename deduplication
* chore(files): remove extraneous comments from export route
* fix(files): sanitize markdown zip entry name, full uuid fallback for filename dedup
* fix(files): extract userId const to satisfy TypeScript narrowing in async callback
* fix(files): use replacer function to prevent $ special-char corruption in markdown URL rewrite
* fix(files): wrap zip buffer in Uint8Array for NextResponse BodyInit compatibility
* lock behavior
* fix(workflow): track resolved isAdmin in prevIsAdminRef to prevent stale lock notification
When workspacePermissions loads asynchronously, prevCanAdminRef (which only
tracked effectivePermissions.canAdmin) would not detect the change, causing
the early-return guard to skip rebuilding the notification with the correct
unlock-button visibility. Track the same resolved value (workspacePermissions
?.viewer?.isAdmin ?? effectivePermissions.canAdmin) that is actually used to
build the notification.
* refactor(uploads): rename server fn to fetchWorkspaceFileBuffer, move client download to uploads/client/download.ts as triggerFileDownload
* more lock updates
* fix(tests): update mocks for fetchWorkspaceFileBuffer rename
* improvement(sidebar): overlay lock indicator on leading icon
* fix(sidebar): correct lock indicator HTML nesting and a11y
* improvement(sidebar): swap lock indicator with more button on hover
* fix(sidebar): gate pointer-events on lock and more button visibility
* fix(sidebar): add role=img so lock indicator is announced by AT
* fix(uploads): direct-to-S3 workspace files + shared transport
* chore(testing): centralize posthog and storage-service mocks
* fix(uploads): address PR review — abort propagation, orphan cleanup, error handling
- Throw immediately on AbortError in KB retry loop (no useless 14s backoff)
- Cleanup S3/Blob object on quota or size-cap rejection in registerUploadedWorkspaceFile
- Enforce MAX_WORKSPACE_FILE_SIZE at registration (defense vs presigned PUT lying about size)
- Handle non-OK / non-JSON responses in workspace-files upload paths
* fix(uploads): add Zod contracts for workspace presigned/register routes
* fix(uploads): correct BlobServiceClient type name in headBlobObject
* fix(uploads): address PR review — typo, complete-failure cleanup, double-increment
* fix(uploads): preserve fallback size and reuse existing display name on re-register
* fix(uploads): surface server error message and bypass quota for local-storage fallback
* fix(uploads): align register response schema with UserFile; skip presigned for KB large files
- registerWorkspaceFileResponseSchema now matches the UserFile shape the route actually returns; previous schema required workspace DB-row fields that were never populated, causing requestJson validation to reject successful uploads.
- KB batch presigned fetch now skips files >= LARGE_FILE_THRESHOLD since multipart bypasses the per-file presigned URL anyway.
* fix(uploads): idempotent register skips duplicate audit/posthog; add edge-case tests
- registerUploadedWorkspaceFile now returns { file, created } so the route can skip captureServerEvent and recordAudit on idempotent re-register (existing metadata reused). Previously a re-register fired duplicate analytics + audit log entries.
- Add tests covering: idempotent re-register skips audit/analytics, isNetworkError matches econnreset/timeout/etc keywords, multipart complete failure fires action=abort cleanup.
* fix(uploads): include 50MiB boundary in batch presigned fetch
* fix(uploads): trust HEAD size to prevent quota inflation
The head.size > 0 fallback let a client PUT 0 bytes and register
with an inflated size, debiting quota without storing data. HEAD
on an existing object always returns the true byte count, so trust
it directly — a genuine 0-byte file correctly contributes 0.
* fix(uploads): audit verified file size, not client-supplied
* fix(uploads): handle register retries and name-collision races
Two bugs in registerUploadedWorkspaceFile:
1. Register retry could orphan storage. When a successful response
was lost on the wire and the client retried, the quota check saw
the bytes already counted, failed, and cleanupOrphan deleted the
already-registered storage object — leaving the DB row pointing
to nothing. Fix: check getFileMetadataByKey before quota guard
and short-circuit on existing record.
2. Concurrent same-named uploads could lose data. allocateUniqueWorkspaceFileName
is best-effort; two racing uploads can pass it and both attempt
the same display name. The loser's insert hits 23505, the catch
block called cleanupOrphan, and successfully-uploaded bytes
were deleted. Fix: retry on 23505 with a fresh allocateUniqueWorkspaceFileName,
matching the pattern in uploadWorkspaceFile. Throw FileConflictError
after exhaustion.
* fix(uploads): retry transient DirectUploadErrors at outer KB level
The KB outer retry only triggered on isNetworkError, missing
transient 5xx from S3/Azure (DirectUploadError code
DIRECT_UPLOAD_ERROR or MULTIPART_ERROR). Adds isTransientUploadError
and retries on it, restoring resilience for small-file presigned
PUTs against flaky cloud storage.
* fix(uploads): only retry transient 5xx, not deterministic 4xx
DirectUploadError now carries the HTTP status. isTransientUploadError
gates on 5xx so callers don't loop on 400/403/404 (e.g., malformed
request, expired signature). Multipart per-part retry also short-circuits
on 4xx — same reasoning.
* refactor(uploads): collapse getFileContentType into resolveFileType
The two helpers differed only in whether application/octet-stream
falls back to the extension map. Add an option flag to resolveFileType
and keep getFileContentType as a thin wrapper for direct-PUT callers
that need to preserve the exact browser-reported content-type.
* chore(uploads): trim verbose comments
Drop inline comments that restate code ("Use the full storageKey as fileName"),
collapse a multi-line block comment into a tighter TSDoc on the existence
check, and prune verbose vitest file headers — describe blocks already
document what's tested.
* fix(uploads): regenerate fileId per insert retry; require cloud storage for register
* fix(uploads): cap formdata fallback at 100MB; drop unused size param
* fix(uploads): abort multipart on get-part-urls failure; retry register on transient errors
* fix(uploads): drop vestigial size field from register contract
* fix(uploads): abort multipart on complete-fetch throw
* fix(uploads): set kb presignedEndpoint fallback; race-safe blob HEAD
* fix(uploads): include ?type=knowledge-base on kb presigned fallback
* fix(uploads): remove abort listener on xhr timeout
* fix(uploads): add timeout/abort to kb api fallback upload
* fix(connectors): harden 10 KB connectors after audit
Validated each issue against provider docs before fixing.
- jira: migrate from deprecated /rest/api/3/search (Atlassian sunset
May 2025) to /rest/api/3/search/jql with nextPageToken pagination
- confluence: unify stub hash across v1 CQL (`when`) and v2
(`createdAt`) paths via shared pageToStub helper using version.number
- salesforce: replace hardcoded login.salesforce.com userinfo with
host fallback so sandbox-issued tokens (test.salesforce.com) work
- servicenow: validate sys_id against /^[a-f0-9]{32}$/ and switch
getDocument to path-based /api/now/table/{table}/{sys_id} to close
encoded-query injection; reject `^` in kbCategory filter
- zendesk: URL-encode Search API query via URLSearchParams; whitelist
ticket statuses; encode locale path segment
- github: add 10MB cap and /git/blobs/{sha} fallback for files >1MB
that /contents/ returns with encoding:"none"
- slack: replace SHA-256 over formatted-message window with metadata
hash slack:{channelId}:{latestTs}:{count} so list and getDocument
agree; cache auth.test team_id on syncContext
- obsidian: drop syncRunId from stub hash (Local REST API has no
HEAD/Last-Modified per OpenAPI spec); fall back to path-only stub
so engine two-stage check short-circuits unchanged notes
- evernote: title fallback for attachments-only notes — breaks
infinite hydration loop where empty plaintext returned null
- google-docs: drop residual `error instanceof Error` pattern
Confluence and Slack hash format changes self-heal with a one-time
re-sync; no data loss.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors/slack): include oldestTs in hash to catch window-shift edits
Audit caught that the metadata hash slack:{channel}:{latestTs}:{count}
misses edits to the oldest message in the rolling window — count and
latestTs both stay constant. Adding oldestTs catches window-shift
when a new message arrives and pushes the oldest out without changing
the newest.
Also drop residual error instanceof Error pattern in validateConfig.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors): address remaining audit findings
- jira: thread VALIDATE_RETRY_OPTIONS through getJiraCloudId so the
validate path uses the tighter retry budget
- confluence: thread VALIDATE_RETRY_OPTIONS through getConfluenceCloudId;
drop residual error instanceof Error pattern
- zendesk: log a warning when statusFilter is set and limit exceeds
the Search API 1000-result cap; add priority to tagDefinitions and
mapTags so the metadata isn't orphaned
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(connectors): address PR review comments
- github: skip blob fetch for empty 0-byte files
- salesforce: add fallback message for empty error
- zendesk: warn on invalid statusFilter instead of silent fallthrough
- evernote: remove dead content.trim() guard
* fix(zendesk): add fallback message for empty validateConfig error
* docs(obsidian): clarify hash strategy and re-hydration behavior
* fix(connectors): address parallel audit findings
- servicenow: case-insensitive sys_id pattern; validate workflowState/incidentState/incidentPriority as numeric, kbCategory via allowlist
- salesforce: include 400 in userinfo host fallthrough for sandbox tokens
- zendesk: add missing 'new' and 'hold' options to ticketStatus dropdown
* fix(servicenow): allow string workflowState values (published/draft/review/retired)
* fix(obsidian): validateConfig must check authenticated field, not just status
GET / is the only public endpoint per the Local REST API spec — it returns
200 regardless of auth and exposes the real signal via response.authenticated.
The prior status-based check let invalid API keys pass validation.
* fix(jira): encode collected count in cursor so maxIssues cap works without syncContext
* fix(connectors): address remaining audit findings
- slack: detect message edits and new threaded replies via edited.ts/latest_reply in contentHash
- github: skip binary files via NUL-byte sniff and filter oversized files at tree-list time
- servicenow: add 'outdated' workflow state to allowlist and dropdown; add Canceled (8) to incident state dropdown
- salesforce: drop 400 from userinfo host fallthrough (Salesforce returns 401/403 for cross-env tokens)
* fix(github): apply binary check to blob fallback path
fetchBlobContent now runs isBinaryBuffer on base64-decoded data and
returns null for binaries; getDocument propagates the null so 1-10MB
binary files are skipped instead of being decoded into garbled UTF-8.
* fix(confluence): reuse pageToStub in getDocument to keep hashes in sync
Replace duplicated versionKey/contentHash logic with a single call to
pageToStub so listDocuments and getDocument can never drift.
* fix(connectors): address audit findings across 7 connectors
- github: branch with slashes encoded per-segment in sourceUrl; treat 403
Contents API responses (>100MB or restricted) as null instead of
throwing; fetchBlobContent throws on unexpected encoding rather than
returning empty content
- jira: ADF extractor handles hardBreak, mention, and emoji nodes
- google-docs: paragraph join uses newline so heading/body boundaries
are preserved
- servicenow: drop legacy 'wiki' field from kb_knowledge requests; only
the 'text' field is reliably present on modern instances
- salesforce: KnowledgeArticleVersion query adds IsLatestVersion=true to
avoid duplicate historical versions; encode externalId in sObject GET
- slack: subtype filter switches to a denylist (SLACK_NOISE_SUBTYPES) so
thread_broadcast / me_message / reminder_add are kept; reply_count
folded into contentHash to detect threaded reply deletes
- confluence: drop bare-string cursor fallback; unparseable cursors now
restart the listing instead of silently re-listing blogposts from 0
* fix(servicenow): allow non-ASCII KB category names
Switch from a \w-based allowlist (ASCII only) to a denylist that
rejects only encoded-query-meaningful characters (^, control chars,
quotes). International category names like 'Général' or 'Ação' are
now accepted.
* fix(servicenow): restore wiki field fallback for kb_knowledge
Wiki-template KB articles populate the wiki field and leave text empty;
HTML-template articles do the opposite. Removing wiki caused wiki-format
articles to resolve to empty content and be silently skipped.
* fix(connectors): jira pagination signal and google-docs paragraph join
- jira: rely solely on absence of nextPageToken for end-of-results;
data.isLast on /rest/api/3/search/jql is unreliable (JRACLOUD-95477)
and the OR-with-isLast logic could truncate pagination early
- google-docs: strip trailing newline from each paragraph before
joining so heading->body produces a single newline, not two
* fix(jira): rely solely on nextPageToken for end-of-results
data.isLast on /rest/api/3/search/jql is unreliable (JRACLOUD-95477)
and the previous OR-with-isLast logic could truncate pagination early
if Jira ever returned isLast=true alongside a valid nextPageToken.
* fix(slack): exclude DM channel IDs from direct lookup
DM (D...) channel IDs require im:*/mpim:* OAuth scopes, which the
connector does not request. The regex now matches only public (C) and
private (G) channel IDs to fail fast with a clearer error instead of
hitting missing_scope from Slack.
* fix(slack): align validateConfig channel ID regex with resolveChannel
The previous fix narrowed the regex in resolveChannel to [CG] but missed
the duplicate in validateConfig, which still admitted DM IDs and would
fall through to a name-based search returning 'Channel not found.'
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(table): make plan table limits configurable via env vars
* fix(table): coerce env table limits to number for skipValidation env
* improvement(env): extract envNumber helper for numeric env coercion
* improvement(knowledge): use envNumber helper for KB_CONFIG_* env reads
* fix(testing): add envNumber to env mock factory
* fix(env): allow zero in envNumber for max-throughput configs
* fix(env): add min option to envNumber for strict-positive configs
* fix(chat): close SSO auth bypass via checkSSOAccess body flag
- Remove checkSSOAccess short-circuit; SSO branch always validates via getSession()
- Skip chat_auth cookie issuance/validation for SSO deployments to prevent replay
- Split eligibility pre-flight into dedicated POST /api/chat/[identifier]/sso route
- Drop .passthrough() and checkSSOAccess from deployed chat contracts
- Add SSO branch test coverage in chat utils
* fix(chat): cast allowedEmails to string[] for SSO eligibility check
* fix(chat): close SSO GET cookie replay and add eligibility rate limit
- Skip chat_auth cookie validation for SSO in GET handler (replay vector for pre-fix cookies)
- Route SSO GET through getSession() instead of always returning auth_required_sso so post-IdP config fetch works
- Add per-IP rate limiting to /api/chat/[identifier]/sso to prevent allowlist enumeration
* feat(files): resolve workspace file page URLs to raw content in markdown preview
* refactor(files): replace regex URL matching with URL constructor in resolveSimFileUrl
* fix(files): render mermaid diagrams in markdown preview using design tokens
Streamdown intercepts fenced code blocks before components.code is called,
so the previous mermaid branch in the code renderer was dead code. Add a
remarkMermaid plugin that transforms mermaid code nodes at the MDAST stage
via data.hName/hProperties so remark-rehype emits a <mermaid-diagram>
element that our MermaidDiagram component handles. This avoids Streamdown's
built-in mermaid renderer which uses mismatched Tailwind semantic classes.
* fix(trace): reduce default tree pane width from 360 to 280
* fix(files): guard resolveSimFileUrl against cross-origin URL hijacking
* refactor(files): use getBrowserOrigin() instead of window.location.origin
* fix(trace): reduce default tree pane width to 240
* fix(files): narrow img src type before passing to resolveSimFileUrl
* fix(files): use narrow props type for img renderer instead of runtime narrowing
* fix(files): accept full ImgHTMLAttributes for img renderer to satisfy Streamdown Components type
* fix(files): treat null getBrowserOrigin as same-origin to prevent SSR hydration mismatch
* improvement(files): use centered aspect-ratio skeleton for mmd file preview
* improvement(files): diagram-shaped skeleton card for mmd file preview
* fix(files): only rewrite relative workspace file URLs to avoid hydration mismatch
* fix(files): pass context not resolved params to parseRequest in view route
* fix(files): simplify mmd file skeleton to match pptx card pattern
* fix(files): match mmd skeleton to actual rendered layout — full-height zoomable area
* fix(sidebar): left-align folder lock icon next to name
* fix(file): zero byte codegen file format
* address comments
* distinguish streaming from actual empty pdf
* fix mermaid diagram state mgmt
* mermaid linter errors sent back to llm
* address comments
* fix autozoom
* Revert "improvement(executor): correctness-by-construction for workflow logs (#4382)"
This reverts commit add55b4ffa.
* fix(terminal): re-read entries inside reconcileFinalBlockLogs loop
For workflows with loop or parallel iterations, finalBlockLogs can
contain multiple terminal logs sharing the same blockId. The prior
code captured entries once before the loop, so entries.find always
matched the same first running entry — later iterations stayed
isRunning: true and got swept to "cancelled" instead of showing
their actual terminal state. Re-read the snapshot per iteration so
each updateConsole's isRunning: false flush narrows the next match.
* chore(terminal): remove dead consoleMode 'add' branch and helpers
Every callsite passes consoleMode: 'update'. Deletes the field, the
unreachable 'add' branches in onBlockCompleted/onBlockError, and the
addConsoleEntry/addConsoleErrorEntry helpers that only the dead
branch invoked.
* fix(executor): reconcile finalBlockLogs on execution:completed
block:completed callbacks fire-and-forget; the last block's event can
arrive after execution:completed, leaving its console entry stuck
isRunning. Mirror the error/cancelled paths: emit finalBlockLogs on
execution:completed and reconcile + sweep on the client.
* fix(executor): emit finalBlockLogs on queued/HITL error and cancel paths
queued-workflow-execution and human-in-the-loop-manager only attached
finalBlockLogs to execution:completed. Without it on cancel/error,
reconcileFinalBlockLogs is a no-op and the client sweep flips
already-completed blocks to canceled. Mirror the route.ts pattern.
* fix(serializer): apply tools.config.params before validating required tool params
* fix(serializer): guard array results and drop redundant fallback in tool param validation
* fix(blocks): align canonicalParamId with tool param name for file inputs
Renames the canonical id from `document` to `file` on firecrawl, reducto v2,
pulse v2, and extend v2 so pre-execution validation resolves the value
under the same key the tool expects, eliminating false "missing required
fields: file" errors at submit time.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore(blocks): drop extraneous comments from canonical file-input renames
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(serializer): drop tools.config.params invocation; enforce canonical-id contract via audit
The serializer's pre-execution validator no longer runs the block's
`tools.config.params` mapper to discover renamed tool param ids. Instead
it relies on the contract that every required+user-only tool param is
backed by a subBlock whose `id` or `canonicalParamId` equals the tool
param id, and a new audit (`bun run check:block-canonical`) enforces
this. Migrates posthog (`personalApiKey` → canonical `apiKey`) so the
audit passes cleanly.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* refactor(scripts): consolidate block registry CI checks into one script
Folds the canonical-id contract audit into the existing subblock ID
stability script and renames it to `check-block-registry.ts`. Both
checks share the same `getAllBlocks()` import and registry-invariant
purpose, so a single CI gate now catches both regression classes.
The early-exit path on the stability check no longer short-circuits
the canonical-id check.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* chore(scripts): unify check-block-registry result reporting
Each check returns a discriminated `CheckResult` (pass | skip | fail)
so the runner prints one definitive line per check instead of mixing a
"skipping" message with a redundant "passed" line. Failure messages
include a per-check header explaining the runtime impact.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* improvement(home): anchor @-mention popup at caret and right-size dropdown widths
* fix(home): align caret-anchor marker to text-top so mention popup clears glyph
* fix(home): enable collision avoidance for @-mention popup so it fits in narrow chats
* improvement(mothership): reuse logs detail panel in resource view
* improvement(logs): drop unnecessary memo and export tab type
* fix(logs): notify embedder on every resolved-tab change
* fix(oauth): trim Atlassian OAuth scopes to fix CloudFront 414
* fix(oauth): restore Confluence scopes whose tools are still active
* fix(oauth): add JSM Forms scopes for form tools
* fix(oauth): restore read:issue.vote:jira scope
Jira issue retrieve tool reads fields.votes.votes and fields.votes.hasVoted
from the GET /rest/api/3/issue payload, which requires the
read:issue.vote:jira granular scope. Restoring to prevent vote data from
being omitted in retrieve responses.
* fix(oauth): drop redundant Jira granular scopes covered by classic
Atlassian recommends <50 scopes per OAuth app to keep authorize URLs
under URL-length limits. Drops 20 granular Jira read/write scopes that
are subsumed by the classic read:jira-work / write:jira-work scopes
already in the list. Existing user tokens are unaffected — Atlassian
refresh keeps originally-granted scopes; the trimmed list only applies
to new authorizations.
Kept granular scopes: delete:* (no classic equivalent) and JSM
granular scopes (separate scope family).
* fix(oauth): re-add read:issue.vote:jira to match PR description
Bugbot flagged that the previous classic-scope collapse dropped this
granular scope while the PR description still claimed it was restored.
Classic read:jira-work covers vote reads, but adding the granular
explicitly keeps the description, code, and intent aligned.
* improvement(executor): correctness-by-construction for workflow logs
Replace the post-hoc reconciliation layer with a deterministic emission
protocol: drain pending callback promises at terminal boundaries, mint a
per-invocation blockExecutionId, and key console entries by that ID.
Eliminates races between block:* and execution:* events without changing
per-block latency.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(executor): remove stale fire-and-forget assertion
The deleted test asserted wrappedOnBlockStart returns before the user
callback resolves. After the Stage 1 drain refactor, wrappedOnBlockStart
must await the user callback so the executor's trackCallback set covers
SSE writes — otherwise the drain at terminal-event time can't guarantee
block:* flushes before execution:*.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(console-store): cover blockExecutionId keying and idempotency
Locks in the new console store invariants:
- Primary lookup via entryIdByBlockExecutionId fires no legacy warn
- Unknown blockExecutionId falls back to legacy keying and warns
- No-blockExecutionId updates use legacy path silently
- addConsole twice with same blockExecutionId returns the existing entry
- Distinct blockExecutionIds (loop iterations) produce distinct entries
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(executor): capture BlockExecutor locally so finally drains its own instance
Previously this.blockExecutor was overwritten on every buildExecutionPipeline
call. Concurrent or re-entrant execute()/executeFromBlock() calls would have
their finally block drain the wrong instance, allowing the first execution's
block events to land after its terminal event. Returning { engine, blockExecutor }
and capturing both locally makes the drain pinned to the same instance the
engine.run() ran against.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* test(terminal): capture store logger by label, not first warn-bearing mock
The previous capture used `.find` over all createLogger results, which
returned whichever module created a logger first — not the store's
logger — causing the legacy-keying warn assertion to see 0 calls.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* improvement(workflow): narrow zustand selectors and optimize log tree builds
- Add useIsCurrentWorkflowExecuting selector; swap broad useCurrentWorkflowExecution in action-bar/chat
- Use useShallow for execution-state subset in useWorkflowExecution
- Drop useCallback-wrapped object selectors in diff-controls and use-block-state (use primitive selectors)
- Stabilize EMPTY_SUBBLOCK_VALUES constant for empty-workflow selector results in api-info-modal, mcp, tag-dropdown
- O(n) Map lookups in buildEntryTree (was O(n^2) filter scans)
- Skip expanded-paths reset when structured-output data is content-stable
- Extract ReactFlow constants out of workflow.tsx into workflow-constants.ts
* fix(workflow): seed structured-output JSON ref and centralize EMPTY_SUBBLOCK_VALUES
- Use null sentinel for prevDataJsonRef and lazily stringify prevDataRef on first compare so the optimization holds on the first stream refresh after mount
- Export EMPTY_SUBBLOCK_VALUES from the subblock store; remove three duplicated module constants
* chore(ci): bump api-validation route baseline to 717
PR #4373 added apps/sim/app/api/table/[tableId]/export/route.ts but didn't
update the audit baseline, so unrelated PRs fail check:api-validation:strict.
Bump baseline to match current route count.
* feat(tables): add export, import column creation, infinite row pagination
- Add `/api/table/[tableId]/export` route streaming CSV/JSON downloads
- Rename `/import-csv` route to `/import` and extend to auto-create new
columns from unmapped CSV headers via `createColumns` form field
- Switch table view to `useInfiniteQuery` so tables larger than 1000
rows fully load; reconcile created rows into the paginated cache so
"New row" past 1000 no longer reverts on invalidate
- Wire scroll-driven prefetch (600px from bottom) and pre-drain pages
before append to keep new-row position consistent
- Polish import-csv dialog flow and add Export action to header
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(table): route boundary validation through Zod contracts
Switch the table query hooks and the import/export routes to the
codebase's contract-based request pattern so the API validation audit
and boundary policy ratchet pass.
- `hooks/queries/tables.ts` now calls every endpoint via
`requestJson(contract, ...)`; the only remaining raw `fetch` calls are
the streaming export download and the multipart CSV upload, both
annotated `boundary-raw-fetch:`.
- The import and export routes parse `params`, the `format` query, and
the multipart form fields with shared schemas from
`@/lib/api/contracts/tables`. Two new contract schemas
(`csvImportCreateColumnsSchema`, `tableExportFormatSchema`) cover the
fields specific to these routes.
- Bumps the audit baseline by one route to account for the new export
endpoint.
* fix(table): address PR bot review
- Move the `isAppendingRowRef` reset into the create-row mutation's
`onSettled` callback. The previous `try/finally` cleared the guard
immediately after `mutate()` returned, before the request completed,
so a rapid second click on "New row" could fire a duplicate create.
- Drop the unused `addTableColumns` wrapper from `lib/table/service`.
The CSV import flow only ever uses the transaction-bound
`addTableColumnsWithTx`; the standalone wrapper was dead code.
* fix(table): re-throw on infinite-query fetch error in append-row drain
`useInfiniteQuery.fetchNextPage()` resolves (rather than rejects) when a
page request fails — the resolved value carries `status: 'error'` while
`hasNextPage` still reflects the last successful page. The drain loop in
`handleAppendRow` relied on a thrown error to bail, so a failed mid-drain
fetch could spin indefinitely and leave the append guard stuck on.
Re-throw inside `fetchNextPageWrapped` when the result is an error so the
caller's `try/catch` runs as intended.
* fix(table): import TABLE_LIMITS from constants to keep server code out of client bundle
The client hook `use-table-data.ts` was importing `TABLE_LIMITS` as a
value from the `@/lib/table` barrel, which transitively pulls in
`service.ts` and the `postgres` driver. Turbopack then tried to bundle
`fs`, `net`, `tls`, and `perf_hooks` into the client component graph and
the production build failed.
Import `TABLE_LIMITS` directly from `@/lib/table/constants` (a pure
constants module) and keep the type imports against the barrel.
* fix(table): run batch unique check inside import transaction
`checkBatchUniqueConstraintsDb` queried the global `db` connection, so
inside a single import transaction (one tx wrapping all batches) the
constraint lookup couldn't see uncommitted rows from prior batches —
duplicates that crossed `CSV_MAX_BATCH_SIZE` boundaries slipped through.
Accept an optional executor and pass `trx` from `batchInsertRowsWithTx`
so the lookup observes the in-flight transaction state.
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
